'Assembly, loading from disk without INT13 AH02

I'm debugging a 16bit bootloader with Bochs and IDA Pro.

I'm searching the point where the bootloader loads the main program from disk to memory. I have located this code segment in the hard disk and later, into the memory. By this I mean that I know that there is a fragment of code on disk and that I know that it will be loaded later because I see how it is running.

I searched for INT 13 in memory (0xCD13) and I have put a breakpoint on all of this interruptions. First time I reached the breakpoint was because the Bochs BIOS is loading the MBR from disk, so far everything normal.

I searched again for INT 13, and I have put new breakpoints in new locations. After continuing with the execution, no breakpoint has reached, and the code has been executed.

I have put a Write Watchpoint in the region of memory where the binary is loaded from disk, to know which part of code is loading this. The surprise is that it has been a fragment of the BIOS code (About 0x5B of the Physical memory).

I don't know what's happening here, who is loading the code? And where? I need help.



Sources

This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.

Source: Stack Overflow

Solution Source